PA-220 Login issue

[R.Moth]

Hi Everyone

We have a load of PA-220's in HA at variuos different sites, after a set period of time the devices stop allowing use to login.  Does not matter what method of Auth we try, it just does not work.  To compond the problem, if we do not resolve this issue eariler enough both devices at the site go offline taking the whole site down.  The issue started around 18 months to 2 years ago.  When we first had the issue we opened several support case with Palo Alto and ended up breaking several devices.  Those devices then had to be replaced by Palo Alto.  Eventually with Palo Alto support we found a workaround.  Here are the steps to get the firewalls back online.

1. Connect with console cable to backup firewall

2. Power cycle the device

3. Go into Maintenance Mode

4. Re-install PANOS.

5. Reboot

6. Once the device is back online and the site is reachable again perform the same steps on the primary firewall.

So, we do have a workaround but that requires someone to be on site with a laptop that can give us access to the devices, which is not always an easy task.  All the PA-220's are located in off site data centers.

I've only been working with Palo Alto devices for about 2.5 years, but my hunch is that 12 of the drives is filling up and causing the problem.  The issue is once we do the reinstall you can see what was the problem.

One of our other senior engineers had reported that he had seen on a PA forum they issue could be linked to a memory issue and restarting a process on both PA's before pushing a configuration update out to the devices from Pnaorama.

Can anyone suggests anything that we can monitor on the devices like memory or storage to see if the issues are related to either memory or storage?

Richard